“Google now promises to preserve IP Address Data for Only 9 Months.”
Brussels, Belgium — A week after modifying the user agreement of its new Chrome browser over privacy complaints, Internet search giant Google Inc., in response to mounting privacy concerns from U.S. and European lawmakers, moved on Tuesday revealed plans that it will be anonymizing all of the users’ IP addresses on its server log after nine months instead of eighteen.
Google earlier introduced an 18-month retention period in 2007.
The Mountain view, California-based company said on its official blog it would reduce the retention time it keeps the search data associated with a user’s unique Internet address to nine months from 18 months currently.
Nicole Wong, Google’s deputy general counsel, told a meeting of computer industry privacy experts at Microsoft Corp.’s Silicon Valley offices that her company planned to “anonymize” the computer addresses of its users more quickly.
“We are significantly shortening our previous 18-month retention policy to address regulatory concerns and to take another step to improve privacy for our users,” Peter Fleischer, global privacy counsel; Jane Horvath, senior privacy counsel; and Alma Whitten, a Google software engineer, wrote in a blog post.
Peter Cullen, chief privacy strategist for Microsoft Corp, said Google’s move was done in response to pressure from European regulators and by industry rivals.
Cullen, who was taking part in panel discussion with Wong, said that until a year-and-a-half ago, Google had kept personally identifiable information about its Web users on company computers for an indefinite amount of time.
Google adopted an 18-month privacy policy only after pressure from the European Union, he said.
“Although that was good for privacy, it was a difficult decision because the routine server log data we collect has always been a critical ingredient of innovation,” according to the blog post.
“We have had literally hundreds of discussions with data protection officials, government leaders and privacy advocates around the world to explain our privacy practices and to work together to develop ways to improve privacy,” Google said.
After that period, the server logs will be anonymized so it becomes impossible to trace an IP address back to an individual. Google, which had previously cut its data-retention time in a nod to privacy concerns, has maintained that analyzing the server logs with full IP addresses collected over an extended period of time allows it to combat fraud, spam and other Internet threats.
Earlier this year, Google, Yahoo, Microsoft and other major ISPs were asked by a House Internet subcommittee to provide detailed information about their data collection and retention policies, a request with which the companies complied. European regulators asked for the same information and Google on Tuesday filed a response that explains the reasoning behind shortening data retention to nine months.
“As the period prior to anonymization gets shorter, the added privacy benefits are less significant and the utility lost from the data grows,” Google’s chief privacy counsels wrote in a blog post. “So, it is difficult to find the perfect equilibrium between privacy on the one hand, and other factors, such as innovation and security, on the other.”
The main issue is that characteristics of data that can help Google prevent fraud can also be a privacy risk, Google said.
“After months of work our engineers developed methods for preserving more of the data’s utility while also anonymizing IP addresses sooner,” the blog post said. “We have not sorted out all of the implementation details, and we may not be able to use precisely the same methods for anonymizing as we do after 18 months, but we are committed to making it work.”
The company, however, is still “concerned about the potential loss of security, quality, and innovation that may result from having less data.”
The change, which applies to Google’s search Web sites worldwide, “is a significant improvement in privacy terms and it puts us ahead of the rest of the industry,” Fleischer told reporters in a conference call.
Fleischer also announced that additional changes are being made to Google’s “Suggest” application, which helps users along by recommending search terms based on what they have already typed. He said Google logs 2 percent of data collected on such searches, but said such records now will all be erased after a 24-hour period, starting this month.
The move comes as Google faces increasing regulatory scrutiny, both as part of the growing concern that large Web companies might know more about their users that people would be comfortable with, and connected with the ongoing antitrust review of its advertising partnership with Yahoo.
While U.S. lawmakers have recently been ramping up their inquiry into Internet companies’ privacy safeguards, Google’s move was largely in response to the complaints of an advisory group to the European Union.
The announcements were meant to appease EU data protection officers who have questioned the need for search engines to keep records of their users’ behavior. However, in a separate report submitted to the EU’s group of national data privacy officers explaining the changes, Google said the new rules would “have costs” for Google’s ability to improve its services by delivering more relevant search results and advertisements.
Earlier this summer, Google added a link to its privacy policy on the Google.com homepage, but not without a fight.
Google initially declined to add the link because the company wanted its homepage to remain as free from clutter as possible, but later agreed to add the link after removing the word “Google” after the copyright symbol.